Race condition in sudo 1.3.1 up to 1.6.8p8, when the ALL pseudo-command is used after a user entry in the sudoers file, allows local users to gain privileges via a symlink attack.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

An updated sudo package is available that fixes a race condition in sudo's pathname validation.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root with logging.

A race condition bug was found in the way sudo handles pathnames. It is possible that a local user with limited sudo access could create a race condition that would allow the execution of arbitrary commands as the root user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1993 to this issue.

Users of sudo should update to this updated package, which contains a backported patch and is not vulnerable to this issue.

Charles Morris discovered a race condition in sudo which could lead to privilege escalation. If /etc/sudoers allowed a user the execution of selected programs, and this was followed by another line containing the pseudo-command 'ALL', that user could execute arbitrary commands with sudo by creating symbolic links at a certain time.

Please note that this does not affect a standard Ubuntu installation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog 

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009.

This security update contains fixes for the following applications :

- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the way that it handles mod_ssl CRL verification callback.  In order for an attacker to exploit this flaw the attacker would need to find a server that was configured to use a malicious certificate revocation list (CRL). 

Todd C. Miller reports :

A race condition in Sudo's command pathname handling prior to Sudo version 1.6.8p9 that could allow a user with Sudo privileges to run arbitrary commands.

Exploitation of the bug requires that the user be allowed to run one or more commands via Sudo and be able to create symbolic links in the filesystem. Furthermore, a sudoers entry giving another user access to the ALL pseudo-command must follow the user's sudoers entry for the race to exist.

A local user who has been granted permission to run commands via sudo could run arbitrary commands as a privileged user due to a flaw in sudo's pathname validation. This bug only affects configurations which have restricted user configurations prior to an ALL directive in the configuration file. A workaround is to move any ALL directives to the beginning of the sudoers file; see the advisory at for more information.

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the way that it handles malformed HTTP requests.  An attacker exploiting this flaw would be able to possibly corrupt cache memory or inject HTML requests to a vulnerable Apache server.  The vulnerability stems from a non-conformance to RFC 2616 that states that HTTP requests must not include both a 'Content-Length' and 'Transfer-Encoding' field.   

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:535 advisory.

    The sudo (superuser do) utility allows system administrators to give     certain users the ability to run commands as root with logging.

    A race condition bug was found in the way sudo handles pathnames. It is     possible that a local user with limited sudo access could create     a race condition that would allow the execution of arbitrary commands as     the root user. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1993 to this issue.

    Users of sudo should update to this updated package, which contains a     backported patch and is not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A race condition was discovered in sudo by Charles Morris. This could lead to the escalation of privileges if /etc/sudoers allowed a user to execute selected programs that were then followed by another line containing the pseudo-command 'ALL'. By creating symbolic links at a certain time, that user could execute arbitrary commands.

The updated packages have been patched to correct this problem.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the way that it handles malformed HTTP requests.  An attacker exploiting this flaw would be able to possibly corrupt cache memory or inject HTML requests to a vulnerable Apache server.  The vulnerability stems from a non-conformance to RFC 2616 that states that HTTP requests must not include both a 'Content-Length' and 'Transfer-Encoding' field.

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the way that it handles mod_ssl CRL verification callback.  In order for an attacker to exploit this flaw the attacker would need to find a server that was configured to use a malicious certificate revocation list (CRL).

ID	Name	Product	Family	Severity
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
21838	CentOS 3 / 4 : sudo (CESA-2005:535)	Nessus	CentOS Local Security Checks	low
20535	Ubuntu 4.10 / 5.04 : sudo vulnerability (USN-142-1)	Nessus	Ubuntu Local Security Checks	low
3308	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Nessus Network Monitor	Operating System Detection	high
20249	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Nessus	MacOS X Local Security Checks	high
3112	Apache < 2.0.55 HTTP Smuggling Vulnerability	Nessus Network Monitor	Web Servers	high
18906	FreeBSD : sudo -- local race condition vulnerability (3bf157fa-e1c6-11d9-b875-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
18603	Debian DSA-735-1 : sudo - pathname validation race	Nessus	Debian Local Security Checks	low
3042	Apache HTTP Request Parsing HTML Injection	Nessus Network Monitor	Web Servers	high
18594	RHEL 4 : sudo (RHSA-2005:535)	Nessus	Red Hat Local Security Checks	high
18550	Mandrake Linux Security Advisory : sudo (MDKSA-2005:103)	Nessus	Mandriva Local Security Checks	low
800798	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Log Correlation Engine	Operating System Detection	high
800576	Apache HTTP Request Parsing HTML Injection	Log Correlation Engine	Web Servers	high
800556	Apache < 2.0.55 HTTP Smuggling Vulnerability	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2005-1993

high

Tenable Plugins

critical

low

low

high

high

high

low

low

high

high

low

high

high

high